Privacy in Schools - Office of the Privacy Commissioner

26
PRIVACY
Application of the
privacy principles
When confronted with a privacy issue within a school, the fi rst step in
addressing the problem is to identify whether or not it is a question about
the collection, storage, use or disclosure of personal information.
This part of the book is an attempt to identify some of the common
privacy issues for schools and then apply the principles to the situation
to assist schools in making their own decisions. It is not meant to be a
statement of the law or a defi nitive legal opinion and if you have any
doubt, you should contact the school’s legal advisers or the Offi ce of
the Privacy Commissioner.
The Board of Trustees is empowered under the Education Act to
manage its school while meeting its statutory obligations. In terms of
the Privacy Act, the Board will have to consider the following issues.
Appointment of a privacy officer
Each school is required to appoint a privacy offi cer. Once appointed,
the privacy offi cer should:
• Attend a training course and make contact with the Offi ce of the
Privacy Commissioner (see www.privacy.org.nz for contact details
and information on training/seminars).
• Undertake an audit of the way the school is handling personal
information including collection, storage, use and disclosure.
• Undertake a review of forms used by the school to ensure compliance
with the collection principles (1-4).
• Undertake a review of the way information is collected in the school
to ensure fairness including:
• opportunities for parents to discuss the forms or obtain
assistance;
• opportunities for parents/students to discuss matters in private,
away from the front reception desk; and
• videotaping, audio taping or photographing any person
(including students) on school grounds with consent or on
notice (eg security cameras).
• Undertake an audit of the way information is stored in the school
and shared amongst staff. There should be reasonable safeguards
to avoid unauthorised access, use, modifi cation or disclosure.
Access to information should be limited to staff who need the
information for their job.
• Develop policies or checklists to deal with information requests from
individuals, guardians/parents or other parties.
• Develop a process for updating records to ensure they are accurate
(eg a half-yearly check with parents to ensure contact details are
correct).
• Undertake a review of information held to determine if it should still
be retained.
Board meetings
Board meetings are usually open meetings at which observers can
attend. There are also minutes from the meetings, which are publicly
available documents.
If there is to be discussion about an individual at a board meeting, then
it is acceptable practice for a resolution to be passed that observers/
non-board members be excluded from all or part of the meeting in
order to protect the privacy of that individual.
The relevant part of the minutes needs to be separated from the public
copy of the minutes and identifi ed as a confi dential document.
Forms
A sample enrolment form is set out in Appendix B, page 47.
As a matter of practicality, information about students and information
about parents/guardians will ordinarily be collected from the parents/
guardians. On occasion, information will be collected from the student
directly.
In considering questions on an enrolment form, schools should look at
each question to work out the information being sought and whether
or not it is necessary for the school’s purposes (see principle 1).
PRIVACY
27